Loading story…
The Dutch Ministry of Finance disclosed that attackers gained unauthorized access to internal systems supporting several primary processes within its policy department. The breach was detected after a third-party notification, and the ministry later blocked access to affected systems while an investigation continued, leaving some employees unable to log in and disrupting internal operations.
The ministry has not said which systems were compromised, how long the intruders had access, how many staff were affected, or whether any sensitive data was stolen. Officials said public-facing services remained operational, including systems used by the Tax Administration, Customs, and the Benefits service for tax collection, import and export processing, and income-linked subsidies, and no threat actor has publicly claimed responsibility.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
By 2026-03-31, the Dutch Ministry of Finance had taken multiple systems offline, including its treasury banking portal, disrupting online treasury services for roughly 1,600 public institutions. The outage blocked functions such as balance viewing, loans, deposits, credit requests, intraday limit changes, and report generation, though funds remained accessible through regular banking channels.
On 2026-03-23, the ministry publicly confirmed the cyber incident and said public-facing services run by the Tax Administration, Customs, and Benefits were not affected. Officials did not disclose which specific systems were impacted, how long access lasted, or whether data was stolen.
After reviewing the incident, the ministry blocked access to compromised systems to contain the breach while an investigation continued. The disruption prevented some employees from logging in and affected internal operations.
On 2026-03-19, the Dutch Ministry of Finance detected unauthorized access to some internal systems after receiving a notification from a third party. The affected systems supported several primary processes within the ministry's policy department.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcenos.nl
Open sourcerijksoverheid.nl
Open sourceismg-cdn.nyc3.cdn.digitaloceanspaces.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026
Spain’s **Ministry of Science, Innovation and Universities** partially shut down its “electronic headquarters,” suspending administrative procedures and disrupting citizen- and company-facing services after reporting a “technical incident” under assessment. A threat actor using the alias **GordonFreeman** claimed responsibility, posted alleged proof-of-breach samples on underground forums, and offered purportedly stolen data for sale; the samples were described as including personal records, email addresses, enrollment applications, and screenshots of official documents, with the actor alleging exploitation of a critical **IDOR** flaw to obtain valid credentials. Separately, Spain’s **Ministry of Finance (Ministerio de Hacienda y Función Pública)** faced an unverified data-breach claim from a threat actor calling themselves **HaciendaSec**, who advertised alleged access to data on **~47.3 million** citizens (including claimed tax identifiers and banking details) on a dark web forum. The Ministry, working with Spain’s **National Cryptologic Centre (CCN)**, stated it found **no evidence** of compromise or exfiltration in internal systems as of the initial investigation, and authorities are assessing whether the dataset is authentic, recycled, or sourced elsewhere; this incident is distinct from an unrelated outage at Rome’s **La Sapienza** university following a suspected ransomware attack.
Jun 29, 2026
Berlin authorities disconnected two state ministries from the city government network after detecting a cybersecurity breach affecting the ministries for urban development, construction and housing, and for mobility, transport, climate protection and the environment. Officials isolated the ministries as a precaution while investigators examined reports that attackers may have exploited a vulnerability in one ministry’s IT systems; German media also reported that data was exfiltrated. Authorities have not publicly identified the threat actor, disclosed the intrusion timeline, or confirmed the full scope of the compromise. The incident left parts of the ministries effectively unable to work, with staff reportedly cut off from email and internet access and relying on phone, SMS, and fax for communication. The disruption also affected public services, including processing of housing benefits and education-related assistance at some district offices. Berlin’s central IT service provider, **ITDZ Berlin**, was reportedly not impacted because the affected ministries operated their portion of the state network independently, though they shared some infrastructure with each other.
Aug 27, 2026